Catfishing

Catfishing is the creation and maintenance of a fictitious online persona — fake name, stolen or AI-generated photos, invented life story — to lure a target into a relationship built on trust that does not exist. The term comes from dating culture, but the technique is a general-purpose social-engineering engine: the same fabricated persona that breaks hearts also empties bank accounts, extracts corporate credentials, and recruits money mules.

How it works

The catfish approaches on dating apps, social networks, or professional platforms, then invests weeks or months in ordinary conversation — the "grooming" phase that makes later requests feel natural. Excuses accumulate for why video calls or meetings never happen, though generative AI increasingly removes even that tell by supplying convincing photos, voices, and live video. Once trust is established, the persona is monetized: as a romance scam asking for emergency money, as the long con of pig butchering steering the victim into fake investment platforms, as a honey trap targeting an employee with access worth stealing, or as leverage for sextortion once intimate material has been exchanged. State-linked groups have run the corporate variant for years, posing as recruiters or attractive industry peers to get defense and tech employees to open malware-laced "job documents."

How to defend against it

For individuals: reverse-image-search profile photos, be suspicious of relationships that escalate quickly but resist live verification, and treat any request for money, gift cards, crypto, or secrecy as the tell it is — no legitimate relationship requires it. For organizations, catfishing is an underestimated workplace threat: employees approached through LinkedIn or private social accounts can be steered into leaking credentials or approving payments long before security tooling sees anything. Cover parasocial and recruiter-persona lures in awareness training, encourage staff to report suspicious approaches without embarrassment, and pair that with payment and access controls that hold even when trust has been manufactured. Our analysis of pig butchering as an enterprise risk shows how far the professionalized version of this deception now reaches into the workforce.